class="kw">package com.hypixel.hytale.server.core.auth;

class="kw">import com.hypixel.hytale.logger.HytaleLogger;
class="kw">import java.nio.charset.StandardCharsets;
class="kw">import java.security.MessageDigest;
class="kw">import java.security.NoSuchAlgorithmException;
class="kw">import java.security.cert.CertificateEncodingException;
class="kw">import java.security.cert.X509Certificate;
class="kw">import java.util.Base64;
class="kw">import java.util.logging.Level;
class="kw">import javax.annotation.Nonnull;
class="kw">import javax.annotation.Nullable;

class="kw">public class CertificateUtil {
   class="kw">private class="kw">static class="kw">final HytaleLogger LOGGER = HytaleLogger.forEnclosingClass();

   class="kw">public CertificateUtil() {
   }

   @Nullable
   class="kw">public class="kw">static String computeCertificateFingerprint(@Nonnull X509Certificate var0) {
      try {
         MessageDigest var1 = MessageDigest.getInstance("SHA-256");
         byte[] var2 = var0.getEncoded();
         byte[] var3 = var1.digest(var2);
         class="kw">return base64UrlEncode(var3);
      } catch (NoSuchAlgorithmException var4) {
         ((HytaleLogger.Api)LOGGER.at(Level.SEVERE).withCause(var4)).log("SHA-256 algorithm not available");
         class="kw">return null;
      } catch (CertificateEncodingException var5) {
         ((HytaleLogger.Api)LOGGER.at(Level.WARNING).withCause(var5)).log("Failed to encode certificate");
         class="kw">return null;
      }
   }

   class="kw">public class="kw">static boolean validateCertificateBinding(@Nullable String var0, @Nullable X509Certificate var1) {
      if (var0 == null || var0.isEmpty()) {
         LOGGER.at(Level.WARNING).log("JWT missing certificate fingerprint (cnf.x5t#S256) - rejecting token");
         class="kw">return false;
      }

      if (var1 == null) {
         LOGGER.at(Level.WARNING).log("No client certificate present in mTLS connection - rejecting token");
         class="kw">return false;
      }

      String var2 = computeCertificateFingerprint(var1);
      if (var2 == null) {
         LOGGER.at(Level.WARNING).log("Failed to compute client certificate fingerprint");
         class="kw">return false;
      }

      boolean var3 = timingSafeEquals(var0, var2);
      if (!var3) {
         LOGGER.at(Level.WARNING).log("Certificate fingerprint mismatch! JWT: %s, Actual: %s", var0, var2);
      } else {
         LOGGER.at(Level.INFO).log("Certificate binding validated successfully");
      }

      class="kw">return var3;
   }

   class="kw">public class="kw">static boolean timingSafeEquals(String var0, String var1) {
      if (var0 != null && var1 != null) {
         byte[] var2 = var0.getBytes(StandardCharsets.UTF_8);
         byte[] var3 = var1.getBytes(StandardCharsets.UTF_8);
         class="kw">return MessageDigest.isEqual(var2, var3);
      } else {
         class="kw">return var0 == var1;
      }
   }

   class="kw">private class="kw">static String base64UrlEncode(byte[] var0) {
      String var1 = Base64.getEncoder().encodeToString(var0);
      class="kw">return var1.replace('+', '-').replace('/', '_').replace("=", "");
   }
}